The ChipSHOUTER® (CW520) is a fully-featured Electromagnetic Fault Injection (EMFI) platform that can be used to discover and characterize vulnerabilities in embedded systems. ChipSHOUTER makes EMFI available to test labs, engineering development firms, educators, and embedded enthusiasts. With a flexible API and bundled practice targets, the system is a platform for experimentation and education right out of the box. Paired with an X-Y table and basic python scripting the ChipSHOUTER becomes a fully automatable EMFI platform capable of precision testing and fault characterization. This kit is designed for conducting attacks and testing in-situ, without the need to use special development boards or to modify the target board. 

ChipSHOUTER uses low-ESR capacitors to dump up to 500V through various E.M. probes. Digital control of charge voltage and fast response times provide you with the E.M. fault injection tool to simplify your fault investigations. Electromagnetic Fault Injection is a powerful attack method that requires careful consideration of how it might apply to your products.

Learn more about EMFI here.

White Paper: Electromagnetic Fault Injection (EMFI) for Automotive Safety & Security Testing with ChipSHOUTER®

Features

• 150 to 500 V Charge Voltage.

• Hardware input with sub-nS jitter, allowing highly accurate injection timings.

• Python API for easy control and scripting.

• Oscilloscope output monitors to see actual glitch inserted into probe tip.

• Comes with 4 probe tips of varying size and polarities.

• Included Ballistic Gel & Simple EMFI Target for validating EMFI settings.

• Optional cooling air input for near-continuous use.

Ballistic Gel EMFI Target

A unique SRAM-based EMFI target includes a large SRAM array. By injecting faults into the array, you can count individual bit flips occurring with different pulse parameters.

You can even see some physical location effects by mapping the SRAM location to address location.

Built for Scripting

The Python 3 API easily allows usage with existing systems, such as connecting an XY table to the ChipSHOUTER setup to scan a device surface.

The ChipSHOUTER also features a simple serial terminal to allow you to use the unit interactively.

A built-in pulse generator allows generating pulses on computer command. For a high-resolution temporal location, a hardware trigger input directly drives the pulse output. This can be controlled by a ChipWhisperer, pulse generator, or custom FPGA board.

Documentation

Specifications

Packing List

GLOBAL AUTHORIZED DISTRIBUTOR

FREE INTERNATIONAL SHIPPING

Outside the USA

CUSTOMS & TAXES 

INCLUDED

Shop in local currency